@jc_stack/ez-agents 0.1.0-beta.52 → 0.1.0-beta.58

package/test/running-work.test.ts

@@ -0,0 +1,175 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { execFile } from 'node:child_process'
+import { promisify } from 'node:util'
+import { mkdtemp, readFile, readdir, rm, stat } from 'node:fs/promises'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import type { Owner } from '../src/control-state.js'
+import { ControlStore } from '../src/control-state.js'
+import { type RunRecord, RunStore } from '../src/runs.js'
+import { type Schedule, Scheduler } from '../src/scheduler.js'
+import { projectRunningWork, formatRunningWork, runningWork } from '../src/running-work.js'
+import { callDeliverySocket, socketPathFor } from '../src/delivery-socket.js'
+import { ownerRun } from './helpers/owner-run.js'
+import { serveTestLedger } from './helpers/ledger.js'
+
+const exec = promisify(execFile)
+const owner: Owner = { telegramUserId: 101, telegramChatId: 101, pairedAt: '2026-01-01T00:00:00Z' }
+const now = Date.parse('2026-10-12T16:00:00Z')
+const run = (id: string, change: Partial<RunRecord> = {}): RunRecord => ({
+  version: 1, id, chatId: 101, telegramUserId: 101, texts: ['PRIVATE PROMPT'], status: 'running',
+  createdAt: '2026-10-12T15:00:00Z', startedAt: '2026-10-12T15:01:00Z', ...change,
+})
+const origin = { id: 'daily', revision: 'revision', dueAt: '2026-10-12T15:00:00Z', pairedAt: owner.pairedAt }
+const execution = { sessionId: 'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa', preset: { id: 'primary', name: 'Primary', cli: 'codex', model: 'fixture-model' } }
+
+test('one view combines foreground, queued and scheduled work with timestamps and honest provenance', () => {
+  const foreground = run('foreground', { execution })
+  const scheduled = run('scheduled', { scheduled: { ...origin, originRunId: 'finished_origin' }, execution })
+  const queued = run('queued', { status: 'queued', startedAt: undefined, scheduled: { ...origin, originRunId: 'foreground' } })
+  const definition: Schedule = { version: 1, ...origin, name: 'Daily report', text: 'PRIVATE SCHEDULE TEXT',
+    trigger: { at: origin.dueAt }, enabled: true, owner, execution }
+  const view = projectRunningWork([queued, scheduled, foreground, run('finished_origin', { status: 'completed' })],
+    [{ id: 'delivery', runId: 'foreground', chatId: 101, createdAt: '2026-10-12T15:55:00Z', text: 'PRIVATE MESSAGE', state: 'sent' }], [definition], owner, now)
+  assert.deepEqual(view.counts, { running: 2, queued: 1 })
+  assert.deepEqual(view.runs.map(item => item.id), ['foreground', 'scheduled', 'queued'])
+  const first = view.runs[0], second = view.runs[1], third = view.runs[2]
+  assert.equal(first.elapsedSeconds, 3540)
+  assert.deepEqual(first.lastObservedActivity, { at: '2026-10-12T15:55:00.000Z', kind: 'delivery-enqueued', ageSeconds: 300 })
+  assert.deepEqual(first.scheduledChildren, [{ id: 'queued', status: 'queued' }])
+  assert.deepEqual(second.origin, { runId: 'finished_origin', relation: 'schedule-origin', status: 'completed', retained: true })
+  assert.equal(second.schedule?.name, 'Daily report')
+  assert.equal(third.startedAt, null); assert.equal(third.elapsedSeconds, null); assert.equal(third.queuedSeconds, 3600)
+  assert.deepEqual(first.nativeChildren, { state: 'unavailable' })
+  const human = formatRunningWork(view), json = JSON.stringify(view)
+  assert.match(human, /2 running, 1 queued/); assert.match(human, /Daily report/); assert.match(human, /completed/)
+  assert.match(human, /Native children: unavailable/); assert.match(human, /schedule-origin|Schedule origin/)
+  assert.ok(!human.includes('PRIVATE') && !json.includes('PRIVATE'))
+})
+
+test('old running records remain running, missing/future telemetry stays unknown, terminals are omitted', () => {
+  const records = [
+    run('stale', { startedAt: '2026-01-02T00:00:00Z' }),
+    run('partial', { startedAt: undefined, execution: { ...execution, preset: { ...execution.preset, model: undefined } } }),
+    run('future', { createdAt: '2026-10-13T00:00:00Z', startedAt: '2026-10-13T01:00:00Z' }),
+    ...(['completed', 'failed', 'cancelled'] as const).map(status => run(status, { status })),
+  ]
+  const before = structuredClone(records)
+  const view = projectRunningWork(records, [], [], owner, now)
+  assert.equal(view.counts.running, 3); assert.equal(view.counts.queued, 0)
+  assert.equal(view.runs.find(item => item.id === 'stale')?.status, 'running')
+  const partial = view.runs.find(item => item.id === 'partial')!
+  assert.equal(partial.elapsedSeconds, null); assert.equal(partial.execution?.model, null)
+  const future = view.runs.find(item => item.id === 'future')!
+  assert.equal(future.elapsedSeconds, null); assert.equal(future.lastObservedActivity, null)
+  assert.match(formatRunningWork(view), /silence is not idle or completion/)
+  assert.deepEqual(records, before, 'a status read must not reconcile, cancel or complete work')
+})
+
+test('fallback metadata uses the latest non-skipped saved setup, and every engine retains its visibility limits', () => {
+  const claude = { id: 'fallback', name: 'Fallback', cli: 'claude', model: 'opus' }
+  const records = ['codex', 'codex-gui', 'claude', 'grok', 'opencode', 'pi'].map(cli => run(cli, {
+    execution: { ...execution, preset: { ...execution.preset, cli, model: cli === 'opencode' ? 'provider/model' : undefined } },
+    nativeSessionId: 'PRIVATE NATIVE SESSION', output: 'PRIVATE ENGINE OUTPUT',
+  }))
+  records.push(run('fallback', { execution: { ...execution, fallbacks: [claude] }, attempts: [
+    { preset: execution.preset, quotaScope: 'codex', outcome: 'failed', startedAt: '2026-10-12T15:01:00Z', endedAt: '2026-10-12T15:02:00Z' },
+    { preset: claude, quotaScope: 'claude', outcome: 'running', startedAt: '2026-10-12T15:03:00Z' },
+    { preset: execution.preset, quotaScope: 'codex', outcome: 'skipped', startedAt: '2026-10-12T15:04:00Z' },
+  ] }))
+  records.push(run('script', { scheduled: origin, script: { id: 'guard', args: ['PRIVATE ARGUMENT'] } }))
+  records.push(run('unknown_engine'))
+  const view = projectRunningWork(records, [], [], owner, now)
+  for (const cli of ['codex', 'codex-gui', 'claude', 'grok', 'opencode', 'pi']) {
+    const item = view.runs.find(item => item.id === cli)!
+    assert.equal(item.execution?.cli, cli)
+    assert.equal(item.execution?.model, cli === 'opencode' ? 'provider/model' : null)
+    assert.deepEqual(item.nativeChildren, { state: 'unavailable' })
+  }
+  const fallback = view.runs.find(item => item.id === 'fallback')!
+  assert.equal(fallback.execution?.cli, 'claude'); assert.equal(fallback.execution?.model, 'opus')
+  assert.equal(fallback.execution?.source, 'latest-attempt'); assert.equal(fallback.execution?.attemptOutcome, 'running')
+  assert.equal(fallback.lastObservedActivity?.at, '2026-10-12T15:04:00.000Z')
+  assert.equal(fallback.lastObservedActivity?.kind, 'setup-skipped')
+  assert.equal(view.runs.find(item => item.id === 'script')?.execution, null)
+  assert.equal(view.runs.find(item => item.id === 'unknown_engine')?.execution, null)
+  assert.ok(!JSON.stringify(view).includes('PRIVATE'))
+})
+
+test('scope excludes revoked/unrelated work; missing origins and stale schedule definitions are not invented', () => {
+  const view = projectRunningWork([
+    run('visible', { scheduled: { ...origin, originRunId: 'other' } }),
+    run('other', { chatId: 202, telegramUserId: 202 }),
+    run('old', { scheduled: { ...origin, pairedAt: 'old-pairing' } }),
+    run('pre-pairing', { createdAt: '2025-12-01T00:00:00Z' }),
+    run('external', { external: { sourceId: 'private', bindingId: 'private', eventIds: ['private'] } }),
+    run('isolated', { taskId: 'private' }),
+    run('app', { application: { bindingId: 'private', scope: 'private', requestId: 'private', inputText: 'PRIVATE APP PROMPT', context: { secret: 'PRIVATE APP CONTEXT' } } }),
+    run('channel', { delivery: { bindingId: 'private', scope: 'private' } }),
+  ], [], [{ version: 1, id: 'daily', revision: 'new-revision', name: 'Wrong revision', owner } as Schedule], owner, now)
+  assert.deepEqual(view.runs.map(item => item.id), ['app', 'channel', 'visible'])
+  assert.equal(view.runs.find(item => item.id === 'app')?.kind, 'application-foreground')
+  const scheduled = view.runs.find(item => item.id === 'visible')!
+  assert.equal(scheduled.schedule?.name, null)
+  assert.deepEqual(scheduled.origin, { runId: 'other', relation: 'schedule-origin', status: null, retained: false })
+  assert.ok(!JSON.stringify(view).includes('PRIVATE'))
+  assert.match(formatRunningWork(view), /status unknown; record unavailable/)
+})
+
+async function files(dir: string) {
+  const result: Record<string, string> = {}
+  for (const name of (await readdir(dir, { recursive: true })).sort())
+    if ((await stat(join(dir, name))).isFile()) result[name] = await readFile(join(dir, name), 'utf8')
+  return result
+}
+
+test('public CLI and socket return sanitized readable/JSON snapshots without changing control files', async t => {
+  const dir = await mkdtemp(join(tmpdir(), 'ez-running-work-'))
+  const foreground = await ownerRun(dir, 'foreground')
+  const ledger = await serveTestLedger(dir)
+  t.after(async () => { await ledger.stop(); await rm(dir, { recursive: true, force: true }) })
+  const control = new ControlStore(dir, 1000), runs = new RunStore(dir), boundOwner = (await control.status()).owner!
+  const definition = await new Scheduler(dir).save({ id: 'daily', name: 'Daily report', text: 'PRIVATE TASK TEXT',
+    owner: boundOwner, execution, originRunId: foreground.id, enabled: true, trigger: { at: new Date(Date.now() + 60_000).toISOString() } }, true)
+  const scheduled = await runs.create({ id: 'scheduled', chatId: 101, telegramUserId: 101, texts: ['PRIVATE PROMPT'], execution,
+    scheduled: { id: definition.id, revision: definition.revision, dueAt: new Date().toISOString(), pairedAt: boundOwner.pairedAt, originRunId: foreground.id } })
+  await runs.patch(scheduled.id, { status: 'running', startedAt: new Date().toISOString(), nativeSessionId: 'PRIVATE SESSION', failureReason: 'PRIVATE FAILURE' })
+  const before = await files(dir)
+  const env = { ...process.env, EZ_CONTROL_DIR: dir, EZ_DELIVERY_SOCKET: ledger.socketPath, EZ_RUN_ID: foreground.id }
+  const cli = (...args: string[]) => exec(process.execPath, ['bin/ezenciel-agents-schedule.mjs', 'running', ...args], { env })
+  const human = (await cli()).stdout, json = (await cli('--json')).stdout, view = JSON.parse(json)
+  assert.match(human, /2 running, 0 queued/); assert.match(human, /Daily report/)
+  assert.equal(view.schemaVersion, 1); assert.equal(view.runs.length, 2)
+  assert.equal(view.runs.find((item: any) => item.id === 'scheduled').origin.runId, foreground.id)
+  assert.ok(!json.includes('PRIVATE') && !human.includes('PRIVATE'))
+  assert.deepEqual(await files(dir), before)
+  assert.equal((await runs.get('scheduled'))?.status, 'running')
+  assert.match((await exec(process.execPath, ['bin/ezenciel-agents-schedule.mjs', '--help'])).stdout, /running \[--json\]/)
+  await assert.rejects(cli('--model', 'override'), /accepts only --json/)
+  await assert.rejects(cli('unexpected-id'), /accepts only --json/)
+})
+
+test('server rejects unauthorized/finished callers, revocation and an unavailable relay instead of reporting idle', async t => {
+  const dir = await mkdtemp(join(tmpdir(), 'ez-running-auth-'))
+  await ownerRun(dir, 'caller')
+  const ledger = await serveTestLedger(dir), runs = new RunStore(dir)
+  t.after(async () => { await ledger.stop(); await rm(dir, { recursive: true, force: true }) })
+  await ownerRun(dir, 'external', { sourceId: 'test', bindingId: 'binding', eventIds: ['1'] })
+  await assert.rejects(callDeliverySocket(socketPathFor(dir), { op: 'runningWork', payload: { callerRunId: 'external' } }), /blocked/)
+  await assert.rejects(runningWork(dir, { callerRunId: '../caller' }), /identifier/)
+  await runs.patch('caller', { replyOnly: true })
+  await assert.rejects(runningWork(dir, { callerRunId: 'caller' }), /Telegram owner/)
+  const application = await runs.create({ id: 'application', chatId: 101, telegramUserId: 101, texts: [],
+    application: { bindingId: 'private', scope: 'private', requestId: 'private' } })
+  await runs.patch(application.id, { status: 'running' })
+  await assert.rejects(runningWork(dir, { callerRunId: application.id }), /Telegram owner/)
+  await runs.patch('caller', { replyOnly: false, status: 'completed' })
+  await assert.rejects(runningWork(dir, { callerRunId: 'caller' }), /No active core run/)
+  await new ControlStore(dir, 1000).revokeOwner()
+  await assert.rejects(runningWork(dir), /No authorized owner/)
+  await ledger.stop()
+  await assert.rejects(exec(process.execPath, ['bin/ezenciel-agents-schedule.mjs', 'running', '--json'], {
+    env: { ...process.env, EZ_CONTROL_DIR: dir, EZ_DELIVERY_SOCKET: ledger.socketPath, EZ_RUN_ID: '' },
+  }), /Delivery relay unavailable/)
+})

package/test/schedule-cli.test.ts

@@ -2,7 +2,7 @@ import test from 'node:test'
 import assert from 'node:assert/strict'
 import { execFile } from 'node:child_process'
 import { promisify } from 'node:util'
-import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { chown, mkdir, mkdtemp, readdir, rm, stat, symlink, writeFile } from 'node:fs/promises'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import { fileURLToPath } from 'node:url'
@@ -42,11 +42,12 @@ test('public scheduler CLI saves literal text, reads back, edits, pauses, and re
  await assert.rejects(exec(process.execPath,[bin,...args],{env}),/exists/)
  assert.equal(JSON.parse((await exec(process.execPath,[bin,'pause','test'],{env})).stdout).enabled,false)
  assert.equal(JSON.parse((await exec(process.execPath,[bin,'resume','test'],{env})).stdout).enabled,true)
- await exec(process.execPath,[bin,'edit','test','--model','custom-model','--effort','low','--cron','0 9 * * 2','--timezone','Asia/Dubai','--text','Tuesday'],{env})
+ const resumed=JSON.parse((await exec(process.execPath,[bin,'show','test'],{env})).stdout)
+ await exec(process.execPath,[bin,'edit','test','--expected-revision',resumed.revision,'--model','custom-model','--effort','low','--cron','0 9 * * 2','--timezone','Asia/Dubai','--text','Tuesday'],{env})
  assert.equal(JSON.parse((await exec(process.execPath,[bin,'show','test'],{env})).stdout).text,'Tuesday')
  const explicit=JSON.parse((await exec(process.execPath,[bin,'show','test'],{env})).stdout)
  assert.equal(explicit.execution.preset.model,'custom-model');assert.equal(explicit.execution.preset.effort,'low')
- await exec(process.execPath,[bin,'edit','test','--cron','0 9 * * 2','--timezone','Asia/Dubai','--text','Tuesday'],{env})
+ await exec(process.execPath,[bin,'edit','test','--expected-revision',explicit.revision,'--cron','0 9 * * 2','--timezone','Asia/Dubai','--text','Tuesday'],{env})
  assert.deepEqual(JSON.parse((await exec(process.execPath,[bin,'show','test'],{env})).stdout).execution,explicit.execution)
  const external=await runs.create({chatId:101,telegramUserId:101,texts:[],execution,external:{sourceId:'source',bindingId:'binding',eventIds:['event']}})
  await runs.patch(external.id,{status:'running'})
@@ -78,17 +79,65 @@ test('edit keeps a paused agent or script schedule paused and an enabled one ena
  const cli=async(...args:string[])=>JSON.parse((await exec(process.execPath,[bin,...args],{env})).stdout)
  const tasks={agent:(text:string)=>['--model','gpt-6-astra','--text',text],script:(name:string)=>['--script','guard','--name',name]}
  for(const [id,task] of Object.entries(tasks)){
-  await cli('create',id,...task('Original'),'--every-seconds','3600')
+  const created=await cli('create',id,...task('Original'),'--every-seconds','3600')
   await cli('pause',id)
   // Changing only the instructions, even with --now, must not resume or dispatch it.
-  const paused=await cli('edit',id,...task('Changed'),'--now')
+  const paused=await cli('edit',id,'--expected-revision',created.revision,...task('Changed'),'--now')
   assert.equal(paused.enabled,false);assert.equal(paused.nextEligibleAt,null)
   assert.equal((await cli('show',id)).enabled,false)
   await cli('resume',id)
-  assert.equal((await cli('edit',id,...task('Again'),'--every-seconds','3600')).enabled,true)
+  assert.equal((await cli('edit',id,'--expected-revision',paused.revision,...task('Again'),'--every-seconds','3600')).enabled,true)
  }
 })
 
+test('edit compares the read revision, refuses busy tasks unless staged and needs the relay',async t=>{
+ const dir=await mkdtemp(join(tmpdir(),'ez-schedule-safe-edit-'));t.after(()=>rm(dir,{recursive:true,force:true}))
+ const ledger=await serveTestLedger(dir);t.after(()=>ledger.stop())
+ const control=new ControlStore(dir,1000),runs=new RunStore(dir)
+ await control.requestPairing(101,101);await control.approveOwner(101)
+ const env={...process.env,EZ_CONTROL_DIR:dir,EZ_RUN_ID:''}
+ const cli=async(...args:string[])=>JSON.parse((await exec(process.execPath,[bin,...args],{env})).stdout)
+ const task=(text:string)=>['--model','gpt-6-astra','--every-seconds','3600','--text',text]
+ assert.match((await exec(process.execPath,[bin,'--help'])).stdout,/edit ID --expected-revision REVISION \[--stage\]/)
+ await assert.rejects(exec(process.execPath,[bin,'create','daily','--stage',...task('Original')],{env}),/apply to edit only/)
+ const created=await cli('create','daily',...task('Original'))
+ await assert.rejects(exec(process.execPath,[bin,'edit','daily',...task('Blind')],{env}),/requires --expected-revision/)
+ const edited=await cli('edit','daily','--expected-revision',created.revision,...task('Edited'))
+ await assert.rejects(exec(process.execPath,[bin,'edit','daily','--expected-revision',created.revision,...task('Stale')],{env}),/changed since revision/)
+ const queued=await runs.create({chatId:101,telegramUserId:101,texts:['[schedule]','Edited'],execution:edited.execution,
+  scheduled:{id:'daily',revision:edited.revision,dueAt:new Date().toISOString(),pairedAt:edited.owner.pairedAt}})
+ await assert.rejects(exec(process.execPath,[bin,'edit','daily','--expected-revision',edited.revision,...task('Busy')],{env}),/queued or running occurrences \(r_/)
+ assert.equal((await cli('show','daily')).revision,edited.revision)
+ const staged=await cli('edit','daily','--expected-revision',edited.revision,'--stage',...task('Staged'))
+ assert.deepEqual(staged.continuingRunIds,[queued.id]);assert.equal(staged.text,'Staged')
+ await ledger.stop()
+ await assert.rejects(exec(process.execPath,[bin,'edit','daily','--expected-revision',staged.revision,'--stage',...task('Offline')],{env}),/Relay unavailable/)
+ assert.equal((await cli('show','daily')).revision,staged.revision)
+})
+
+test('a root operator command acts as the control directory owner and cannot follow a planted symlink',{skip:process.geteuid?.()!==0},async t=>{
+ const dir=await mkdtemp(join(tmpdir(),'ez-schedule-root-')),target=await mkdtemp(join(tmpdir(),'ez-root-target-')),runtime=20000
+ t.after(()=>Promise.all([rm(dir,{recursive:true,force:true}),rm(target,{recursive:true,force:true})]))
+ const control=new ControlStore(dir,1000);await control.requestPairing(101,101);await control.approveOwner(101)
+ const ledger=await serveTestLedger(dir);t.after(()=>ledger.stop())
+ const workspace=join(dir,'workspace');await mkdir(workspace);await writeFile(join(workspace,'guard.mjs'),'')
+ // The runtime user owns its control directory, as the container entrypoint provisions it.
+ await chown(dir,runtime,runtime);for(const name of await readdir(dir))await chown(join(dir,name),runtime,runtime)
+ await chown(join(workspace,'guard.mjs'),runtime,runtime)
+ const env={...process.env,EZ_CONTROL_DIR:dir,EZ_RUN_ID:'',EZ_AGENT_WORKSPACE:workspace}
+ const cli=async(...args:string[])=>JSON.parse((await exec(process.execPath,[bin,...args],{env,cwd:workspace})).stdout)
+ const task=['--model','gpt-6-astra','--every-seconds','3600','--text','Root operator']
+ const created=await cli('create','daily',...task)
+ const edited=await cli('edit','daily','--expected-revision',created.revision,...task)
+ await cli('script','register','guard','--file','guard.mjs','--interpreter','node')
+ for(const path of ['schedules','schedules/daily.json',`schedules/daily.${edited.revision}.cursor`,'scripts/guard.json'])
+  assert.equal((await stat(join(dir,path))).uid,runtime,path)
+ // An agent can replace its own control subdirectory; root must not write through it.
+ await rm(join(dir,'schedules'),{recursive:true});await symlink(target,join(dir,'schedules'))
+ await assert.rejects(exec(process.execPath,[bin,'create','other',...task],{env}),/EACCES|permission denied/)
+ assert.deepEqual(await readdir(target),[]);assert.equal((await stat(target)).uid,0)
+})
+
 test('executor PATH exposes the extensionless scheduler command',async()=>{
  const command=fileURLToPath(new URL('../bin/ezenciel-agents-schedule',import.meta.url))
   assert.match((await exec(command,['--help'])).stdout,/Creates a scheduled task/)

package/test/scheduler.test.ts

@@ -1,6 +1,6 @@
 import test from 'node:test'
 import assert from 'node:assert/strict'
-import { mkdtemp, rm, writeFile, readFile, stat } from 'node:fs/promises'
+import { mkdtemp, rm, writeFile, readFile, stat, readdir, utimes } from 'node:fs/promises'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import { randomUUID } from 'node:crypto'
@@ -178,3 +178,130 @@ test('missing models cannot be saved, dispatched or triggered; legacy settings r
  assert.equal(run.execution?.preset.model,f.input.execution.preset.model)
  assert.equal(run.scheduled?.revision,repaired.revision)
 })
+
+// Safe updates: an edit never invalidates an occurrence that is already queued
+// or running, and definition writes serialize with dispatch on the schedule lock.
+test('edit applies only from the expected revision and keeps a concurrent pause',async t=>{
+ const f=await fixture(t), s=await f.scheduler.save(f.input,true), list=()=>f.runs.list()
+ const first=await f.scheduler.edit({...f.input,text:'First'},s.revision,list)
+ await assert.rejects(f.scheduler.edit({...f.input,text:'Stale'},s.revision,list),/changed since revision/)
+ assert.equal((await f.scheduler.get(s.id)).text,'First')
+ const racing=await Promise.allSettled(['A','B'].map(text=>f.scheduler.edit({...f.input,text},first.revision,list)))
+ const won=racing.filter(r=>r.status==='fulfilled')
+ assert.equal(won.length,1,'two edits from one revision cannot both apply')
+ assert.match(String((racing.find(r=>r.status==='rejected') as PromiseRejectedResult).reason),/changed since revision/)
+ const latest=await f.scheduler.get(s.id)
+ assert.equal(latest.revision,(won[0] as PromiseFulfilledResult<typeof latest>).value.revision)
+ // Pause keeps the revision; an edit read before it must not resume the task.
+ await f.scheduler.enable(s.id,false)
+ assert.equal((await f.scheduler.edit({...f.input,enabled:true,text:'After pause'},latest.revision,list)).enabled,false)
+ assert.deepEqual((await readdir(join(f.dir,'schedules'))).filter(name=>name.endsWith('.lock')),[])
+})
+test('edit refuses a busy task; a staged edit lets queued and running occurrences finish on captured settings',async t=>{
+ const f=await fixture(t), list=()=>f.runs.list()
+ const s=await f.scheduler.save({...f.input,trigger:{everySeconds:60,start:new Date(f.now).toISOString()}},true)
+ await f.scheduler.tick(f.owner,f.runs,f.now)
+ const [queued]=await f.runs.list()
+ const changed={...f.input,text:'New instructions',trigger:s.trigger,execution:{...f.input.execution,preset:{...f.input.execution.preset,model:'new-model'}}}
+ await assert.rejects(f.scheduler.edit(changed,s.revision,list),new RegExp(`queued or running occurrences \\(${queued.id}\\)`))
+ assert.equal((await f.scheduler.get(s.id)).revision,s.revision)
+ assert.equal(await f.scheduler.current(queued,f.owner),true,'a refused edit leaves the queued occurrence admissible')
+ await f.runs.patch(queued.id,{status:'running'})
+ const staged=await f.scheduler.edit(changed,s.revision,list,true)
+ assert.deepEqual(staged.continuingRunIds,[queued.id])
+ // Admission and fallback advancement keep accepting the captured occurrence.
+ assert.equal(await f.scheduler.current(queued,f.owner),true)
+ const captured=(await f.runs.get(queued.id))!
+ assert.equal(captured.texts[1],'Do the work');assert.equal(captured.execution?.preset.model,'fixture-model')
+ assert.equal((await f.scheduler.listTasksReadOnly(await f.runs.list()))[0].runState,'running')
+ await f.scheduler.tick(f.owner,f.runs,f.now+600000)
+ assert.equal((await f.runs.list()).length,1,'the staged revision waits for the running occurrence')
+ await f.runs.patch(queued.id,{status:'completed'})
+ await f.scheduler.tick(f.owner,f.runs,f.now+600000)
+ const next=(await f.runs.list()).find(r=>r.id!==queued.id)!
+ assert.equal(next.scheduled?.revision,staged.revision)
+ assert.equal(next.texts[1],'New instructions');assert.equal(next.execution?.preset.model,'new-model')
+ await f.runs.patch(next.id,{status:'completed'})
+ const idle=await f.scheduler.edit({...changed,text:'Idle edit'},staged.revision,list)
+ assert.equal(idle.continuingRunIds,undefined)
+ assert.equal(await f.scheduler.current(queued,f.owner),false)
+})
+test('a dispatch never lands between an edit check and its write',async t=>{
+ const f=await fixture(t), s=await f.scheduler.save(f.input,true)
+ // The edit holds the lock while it reads the ledger: a concurrent tick skips the task.
+ const applied=await f.scheduler.edit({...f.input,text:'Edited'},s.revision,async()=>{
+  await f.scheduler.tick(f.owner,f.runs,f.now)
+  return f.runs.list()
+ })
+ assert.equal((await f.runs.list()).length,0)
+ await f.scheduler.tick(f.owner,f.runs,f.now)
+ const [run]=await f.runs.list()
+ assert.equal(run.scheduled?.revision,applied.revision);assert.equal(run.texts[1],'Edited')
+ assert.equal(await f.scheduler.current(run,f.owner),true)
+ // The dispatcher holds the lock while it queues: an edit started then sees the occurrence.
+ const g=await fixture(t), saved=await g.scheduler.save(g.input,true)
+ let editing:Promise<unknown>|undefined, staging:Promise<unknown>|undefined
+ const hooked=Object.assign(Object.create(g.runs) as RunStore,{create:async(...args:Parameters<RunStore['create']>)=>{
+  editing=g.scheduler.edit({...g.input,text:'Too late'},saved.revision,()=>g.runs.list())
+  staging=g.scheduler.edit({...g.input,text:'Staged'},saved.revision,()=>g.runs.list(),true)
+  return g.runs.create(...args)
+ }})
+ await g.scheduler.tick(g.owner,hooked,g.now)
+ const results=await Promise.allSettled([editing!,staging!])
+ const [dispatched]=await g.runs.list()
+ assert.equal(dispatched.scheduled?.revision,saved.revision)
+ assert.ok(results.some(r=>r.status==='rejected' && /queued or running|changed since revision/.test(String(r.reason))),'an unstaged edit cannot replace a busy task')
+ assert.equal(await g.scheduler.current(dispatched,g.owner),true,'the queued occurrence stays admissible')
+})
+test('concurrent dispatch, trigger and edit never leave an occurrence that admission would cancel',async t=>{
+ const f=await fixture(t), jitter=()=>new Promise(resolve=>setTimeout(resolve,Math.random()*4))
+ for(let i=0;i<30;i++){
+  const id=`race-${i}`, stage=i%2===1
+  const s=await f.scheduler.save({...f.input,id},true)
+  const [,,edited]=await Promise.allSettled([
+   jitter().then(()=>f.scheduler.tick(f.owner,f.runs,f.now)),
+   jitter().then(()=>f.scheduler.trigger(id,s.revision,`key-${i}`,f.owner,f.runs)),
+   jitter().then(()=>f.scheduler.edit({...f.input,id,text:`Edited ${i}`},s.revision,()=>f.runs.list(),stage)),
+  ])
+  const occurrences=(await f.runs.list()).filter(r=>r.scheduled?.id===id)
+  assert.ok(occurrences.length<=1,'one queued or running occurrence per task')
+  for(const run of occurrences)assert.equal(await f.scheduler.current(run,f.owner),true,`${id} ${run.scheduled?.revision} would be cancelled`)
+  if(edited.status==='rejected')assert.match(String(edited.reason),/queued or running/)
+  else if(!stage)assert.ok(occurrences.every(r=>r.scheduled?.revision===edited.value.revision))
+  for(const run of occurrences)await f.runs.patch(run.id,{status:'completed'})
+ }
+ assert.deepEqual((await readdir(join(f.dir,'schedules'))).filter(name=>name.endsWith('.lock')),[])
+})
+test('a lock left by a crashed writer expires; a live one makes dispatch wait',async t=>{
+ const f=await fixture(t), s=await f.scheduler.save(f.input,true), lock=join(f.dir,'schedules',`${s.id}.lock`)
+ await writeFile(lock,'')
+ await f.scheduler.tick(f.owner,f.runs,f.now)
+ assert.equal((await f.runs.list()).length,0)
+ const old=new Date(Date.now()-60000);await utimes(lock,old,old)
+ await f.scheduler.tick(f.owner,f.runs,f.now)
+ assert.equal((await f.runs.list()).length,1)
+ await assert.rejects(stat(lock),{code:'ENOENT'})
+})
+test('a holder whose lock expired never releases the next holder',async t=>{
+ const f=await fixture(t), lock=(f.scheduler as unknown as {lock:(id:string)=>Promise<()=>Promise<void>>}).lock.bind(f.scheduler)
+ const file=join(f.dir,'schedules/test.lock'), first=await lock('test')
+ const old=new Date(Date.now()-60000);await utimes(file,old,old)
+ const second=await lock('test')
+ await first();await stat(file)
+ await second();await assert.rejects(stat(file),{code:'ENOENT'})
+})
+test('an occurrence of a removed task does not make its recreated task busy',async t=>{
+ const f=await fixture(t), s=await f.scheduler.save(f.input,true)
+ await f.scheduler.tick(f.owner,f.runs,f.now)
+ const [old]=await f.runs.list()
+ await f.scheduler.remove(s.id)
+ const again=await f.scheduler.save(f.input,true)
+ const edited=await f.scheduler.edit({...f.input,text:'Recreated'},again.revision,()=>f.runs.list(),true)
+ assert.equal(edited.continuingRunIds,undefined)
+ assert.equal(await f.scheduler.current(old,f.owner),false,'the removed task occurrence stays non-current')
+})
+test('continuing occurrences must be valid record identifiers',async t=>{
+ const f=await fixture(t), s=await f.scheduler.save(f.input,true)
+ await writeFile(join(f.dir,'schedules/test.json'),JSON.stringify({...s,continuingRunIds:['../escape']}))
+ await assert.rejects(f.scheduler.get('test'),/Invalid schedule record/)
+})

package/test/script-schedules.test.ts

@@ -104,7 +104,7 @@ test('agent registers and schedules a script natively; script runs cannot change
   await f.runs.patch(scriptRun.id, { status: 'running' })
   const asScript = { env: { ...env, EZ_RUN_ID: scriptRun.id }, cwd: f.workspace }
   for (const args of [['script', 'update', 'book-freshness'], ['script', 'register', 'other', '--file', 'scripts/guard.mjs', '--interpreter', 'node'],
-    ['edit', 'actual-book-freshness-guard', '--script', 'book-freshness', '--now'], ['pause', 'daily'], ['trigger', 'daily', '--key', 'k']])
+    ['edit', 'actual-book-freshness-guard', '--expected-revision', schedule.revision, '--script', 'book-freshness', '--now'], ['pause', 'daily'], ['trigger', 'daily', '--key', 'k']])
     await assert.rejects(exec(process.execPath, [bin, ...args], asScript), /Script runs cannot change scripts or schedules/)
   assert.equal(JSON.parse((await exec(process.execPath, [bin, 'script', 'show', 'book-freshness'], asScript)).stdout).id, 'book-freshness')
   // A relative --file resolves from the caller's directory, stored relative to the workspace.
@@ -123,9 +123,9 @@ test('script CLI creates, preserves and explicitly clears preflight gates', asyn
  const options=['--script','guard','--at','2027-09-09T09:00:00+04:00']
  const created=await cli('create','gated',...options,'--preflight-file',file)
  assert.deepEqual(created.preflight,preflight)
- const edited=await cli('edit','gated',...options,'--name','Renamed')
+ const edited=await cli('edit','gated','--expected-revision',created.revision,...options,'--name','Renamed')
  assert.deepEqual(edited.preflight,preflight)
- const cleared=await cli('edit','gated',...options,'--clear-preflight')
+ const cleared=await cli('edit','gated','--expected-revision',edited.revision,...options,'--clear-preflight')
  assert.equal(cleared.preflight,undefined)
 })